{"id":"EUVD-2026-23550","enisaUuid":"ff972eaa-3b09-3e56-8ba4-17cf5e40e5f6","description":"zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected. Version 2.0.1 patches the issue.","datePublished":"Apr 17, 2026, 9:01:51 PM","dateUpdated":"Apr 20, 2026, 4:19:07 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/openziti/zrok/security/advisories/GHSA-cpf9-ph2j-ccr9\nhttps://github.com/openziti/zrok/releases/tag/v2.0.1\n","aliases":"CVE-2026-40303\nGHSA-cpf9-ph2j-ccr9\n","assigner":"GitHub_M","epss":0.45,"enisaIdProduct":[{"id":"e06546b8-a4d7-3925-aa9b-c8cf8455be2c","product":{"name":"zrok","vendor":{"name":"openziti"}},"product_version":"\u003c 2.0.1"}],"enisaIdVendor":[{"id":"007419bd-595b-32d2-86c2-998d4abc05f6","vendor":{"name":"openziti"}}],"enisaIdVulnerability":[{"id":"3cc37107-8d2b-3a58-8a55-b38e9296a3c8","vulnerability":{"id":"GHSA-cpf9-ph2j-ccr9","description":"zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing","datePublished":"Apr 16, 2026, 9:09:08 PM","dateUpdated":"Apr 24, 2026, 8:48:49 PM","baseScore":0.0,"references":"https://github.com/openziti/zrok/security/advisories/GHSA-cpf9-ph2j-ccr9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40303\nhttps://github.com/openziti/zrok\nhttps://github.com/openziti/zrok/releases/tag/v2.0.1\n","enisa_id":"EUVD-2026-23550\n","aliases":"CVE-2026-40303\nGHSA-cpf9-ph2j-ccr9\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9e6113e5-e04b-3c83-a5bd-522637ebd62e","vulnerability":{"id":"CVE-2026-40303","description":"zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected. Version 2.0.1 patches the issue.","datePublished":"Apr 17, 2026, 9:01:51 PM","dateUpdated":"Apr 20, 2026, 4:19:07 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/openziti/zrok/security/advisories/GHSA-cpf9-ph2j-ccr9\nhttps://github.com/openziti/zrok/releases/tag/v2.0.1\n","enisa_id":"EUVD-2026-23550\n","assigner":"GitHub_M","epss":0.45,"dataProcessed":"Nov 1, 2026, 7:17:12 AM","vulnerabilityProduct":[{"id":"f9df292d-e47e-307a-a1b2-d67f853b547d","product":{"name":"zrok","vendor":{"name":"openziti"}},"product_version":"\u003c 2.0.1"}],"vulnerabilityVendor":[{"id":"cbe7d93e-ed5a-3fb7-9de0-5cef2aba8e4a","vendor":{"name":"openziti"}}]}}],"enisaIdAdvisory":[]}